Spotting Phishing Pages That Hide From Security Scanners

Understanding how cloaking works helps you treat scanner results with the right amount of caution, recognise phishing pages yourself and write reports that help security teams take them down faster.

What cloaking means

Cloaking is the practice of showing different content to different visitors. A phishing page that uses cloaking decides, within a fraction of a second, whether the visitor looks like a potential victim or like a security scanner, a researcher or a search engine. Victims see the fake login or payment form. Everyone else sees an empty page, an error, a harmless website or a redirect to the genuine brand. Because many automated defences only check a link once, from one location, a well-cloaked page can stay online for days while it collects real victims' data.

Common tricks phishing kits use

Phishing kits sold on criminal forums increasingly include cloaking features as standard:

• IP and network filtering. The page checks the visitor's IP address against lists of security companies, cloud providers and hosting firms, where most scanners run, and blocks them.
• Geofencing. A scam aimed at customers of a bank in one country only shows itself to visitors from that country.
• Device checks. Many SMS scams only display the fraudulent page on mobile phones, showing desktop visitors nothing.
• One-time or personalised links. Each message contains a unique token, and the page works only once or only for the original recipient.
• Bot challenges. Some pages place a CAPTCHA or browser check in front of the scam, which automated scanners often cannot pass.
• Delayed activation. A domain may host harmless content when it is first checked and switch to the phishing page later.

Why a clean scanner result is not proof

URL scanners and browser warnings are valuable and catch enormous numbers of threats. But a clean result only means the scanner did not see anything malicious when it looked, from where it looked. If the page was cloaked, the scanner may simply have been shown the decoy. That is why your own judgement remains the most important layer of protection, especially for links that arrive unexpectedly.

Warning signs you can check yourself

• The message created urgency. Fees, suspended accounts, missed deliveries and security alerts that demand action now are classic pressure tactics.
• The domain does not match the brand. Look carefully at the address. Extra words, unusual endings and misspellings are red flags, however professional the page looks.
• The link was unexpected. Legitimate companies rarely ask you to pay or log in through a link in a text message.
• The padlock proves nothing. HTTPS only means the connection is encrypted, not that the site is honest. Most phishing pages now use it.
• The page asks for more than it should. A delivery fee request that also wants your full card details, bank login or one-time codes is a scam.

When in doubt, close the message and go to the company's website or app directly by typing the address yourself.

How analysts see what victims see

Security teams and community researchers who verify reported scams face the same cloaking problem as scanners, so they deliberately make their checks look like a real victim's visit. They open suspicious links inside isolated virtual machines or dedicated analysis browsers, never on personal devices, and they match the conditions the scam expects: a mobile browser for an SMS scam, and an internet connection that appears to come from an ordinary household in the targeted country. To get that last part right, many analysts route their checks through residential-grade addresses such as Proxy-Cheap isp proxies, which use IP ranges registered to real internet providers rather than to cloud companies, so the cloaking filter has no reason to hide the page. Comparing the result with what a datacenter scanner saw often confirms cloaking in seconds.

This kind of verification should only ever be done for defensive purposes, in an isolated environment, and without entering any real personal or payment information into the suspicious page.

Reporting a cloaked page

Reports from the public are one of the main ways phishing pages are found and taken down, and a few extra details make yours far more useful:

• Forward the original message. The Anti-Phishing Working Group accepts phishing emails and shares them with its members, including registrars and hosting companies.
• Report the URL to browsers. Submitting the link to Google Safe Browsing can lead to warnings that protect Chrome, Firefox and Safari users.
• Mention the conditions. Note your country, whether you opened it on a phone, and that the page may appear clean to scanners. That tells analysts how to reproduce it.
• Warn the impersonated company. Most brands have a dedicated address for reporting phishing that abuses their name.

If you have already entered information into a suspicious page, contact your bank or the affected service immediately, change any passwords you used and enable two-factor authentication.

Conclusion

Cloaking turns phishing into a game of hide and seek: scammers show the danger only to the people they want to rob and a blank face to everyone checking. Scanner results are still worth using, but they are a starting point rather than a guarantee. Combine them with your own judgement, recognise the warning signs, and when you report a scam, include the details that help analysts see what you saw. Every well-written report makes the next cloaked page a little easier to catch.